What is claimed is: 



CLAIMS 



11. A method for rule-based network management, the method comprising the computer- 

2 implemented steps of: 

3 defining and storing a set of rules in one or more Rule-Based Markup Language 

4 ("RBML") documents, wherein the one or more RBML docimients include 

5 one or more tags defining one or more rule elements, and wherein the set of 

6 rules includes: 

7 a symptom-event rule that identifies as a symptom a particular event occurring 

8 within the network; and 

9 a problem-diagnosis rule that defines a problem within the network as a 

10 correlation between one or more symptoms; 

1 1 collecting and storing symptom-related data about one or more symptoms, wherein 

12 collecting and storing the symptom-related data includes monitoring the 

13 network for one or more network events identified in the symptom-event rule; 

14 and 

1 5 detecting a problem within the network, wherein detecting the problem includes 

1 6 applying the problem-diagnosis rule to the symptom-related data. 

12. A method as recited in Claim 1 , the method further comprising reviewing the set of 
2 rules to identify and resolve a conflict between two or more rules in the set. 

1 3. A method as recited in Claim 1 , the method fiirther comprising storing the one or 

2 more RBML documents in a rule repository, wherein the rule repository includes one or 

3 more directories containing RBML documents. 

1 4. A method as recited in Claim 1 , wherein a RBML document storing the problem- 

2 diagnosis rule includes: 

3 a problem-definition tag describing a problem; and 
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4 a correlation tag identifying the correlation between one or more symptoms, wherein 

5 the one or more symptoms are defined in one or more symptom tags that 

6 include one or more pre-defined indicators associated with the one or more 

7 symptoms. 

1 5. A method as recited in Claim 4, wherein the step of detecting a problem within the 

2 network further comprises the steps of: 

3 comparing the symptom-related data to the one or more pre-defined indicators 

4 associated with a particular symptom to determine whether the particular 

5 symptom exists in the symptom-related data; 

6 repeating the step of comparing the symptom-related data for all symptoms identified 

7 in the correlation tag of the RBML document storing the problem-diagnosis 

8 rule; and 

9 only if all symptoms identified in the correlation tag exist, determining that the 
1 0 problem identified in the problem-definition tag is detected. 

16. A method as recited in Claim 1, wherein a RBML document storing the symptom- 

2 event rule includes: 

3 an event tag identifying the particular event occurring on the network; and 

4 a symptom tag identifying a symptom as a generalized abstraction of the particular 

5 event. 

17. A method as recited in Claim 6, wherein the RBML document storing the symptom- 

2 event rule fiirther includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 
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18. A method as recited in Claim 1, wherein: 

2 the set of rules further includes a problem-correction rule defining one or more 

3 corrective actions capable of correcting the problem within the network; and 

4 the method further comprises the step of reconraiending to a user one or more 

5 corrective actions defined in a RBML document storing the problem- 

6 correction rule. 

19. A method as recited in Claim 8, the method further comprising the step of applying to 

2 a network device, without user intervention, one or more corrective actions defined in the 

3 problem-correction rule. 

1 10. A method as recited in Claim 1 , wherein: 

2 the network is a first network in a plurality of networks; and 

3 the method further comprises the steps of: 

4 receiving a request from a user to employ a particular rule in managing a 

5 second network, separate from the first network; and 

6 distributing to a device on the second network the one or more RBML 

7 documents storing the particular rule. 

1 11. A method for defining a Rule-Based Markup Language ("RBML") to describe a set 

2 of rules for managing a network, the method comprising the computer-implemented steps of: 

3 creating one or more RBML documents for storing the set of rules, wherein the one or 

4 more RBML documents include one or more tags defining one or more rule 

5 elements, and wherein: 

6 a RBML document storing a symptom-event rule firom the set of rules 

7 includes: 

8 an event tag identifying a particular event occurring on the network; 

9 and 

10 a symptom tag identifying a symptom as a generalized abstraction of 

1 1 the particular event; and 
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12 a RBML docximent storing a problem-diagnosis rule from the set of rules 

13 includes: 

14 a problem-definition tag describing a problem; and 

15 a correlation tag identifying a correlation between one or more 

16 symptoms, wherein the one or more symptoms are defined in 

1 7 one or more symptom tags that include one or more pre- 

1 8 defined indicators associated with the one or more symptoms; 

19 and 

20 generating, from information stored in one or more tags of the one or more RBML 

21 documents, one or more sequences of instructions, which instructions, when 

22 executed by one or more processors, cause the one or more processors to carry 

23 out the steps of: 

24 collepting and storing symptom-related data about one or more symptoms, 

25 wherein collecting and storing the symptom-related data includes 

26 monitoring the network for one or more network events identified in 

27 the symptom-event rule; and 

28 detecting a problem within the network, wherein detecting the problem 

29 includes applying the problem-diagnosis rule to the symptom-related 

30 data. 

1 12. A method as recited in Claim 1 1, wherein the step of detecting a problem within the 

2 network further comprises the steps of: 

3 comparing the symptom-related data to the one or more pre-defined indicators 

4 associated with the one or more symptoms to determine whether a particular 

5 symptom exists in the symptom-related data; 

6 repeating the step of comparing the symptom-related data for all symptoms identified 

7 in the correlation tag of the RBML document storing the problem-diagnosis 

8 rule; and 

9 only if all symptoms identified in the correlation tag exist, determining that the 
10 problem identified in the problem-definition tag is detected. 
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1 13. A method as recited in Claim 11, wherein the RBML document storing the symptom- 

2 event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, retums symptom- 

6 related data associated with the particular network device. 

1 14. A method as recited in Claim 1 1 , wherein: 

2 the step of creating one or more RBML docmnents fiirther includes creating a RBML 

3 document for storing a problem-correction rule defining one or more 

4 corrective actions capable of correcting the problem within the network; and 

5 the step of generating instructions includes generating one or more sequences of 

6 instructions, which instructions, when executed by the one or more 

7 processors, cause the one or more processors to carry out the step of 

8 recommending to a user the one or more corrective actions defined in the 

9 RBML document storing the problem-correction rule. 

1 15. An apparatus for rule-based network management, comprising: 

2 a rule editor for creating and storing, in one or more Rule-Based Markup Language 

3 ("RBML") documents containing one or more tags, a set of rules employed in 

4 managing the network, wherein the set of rules includes: 

5 a symptom-event rule that identifies as a symptom a particular event occurring 

6 within the network; and 

7 a problem-diagnosis rule that defines a problem within the network as a 

8 correlation between one or more symptoms; 

9 one or more processors; 

10 a diagnosis engine including one or more stored sequences of instructions which, 

1 1 when executed by the one or more processors, cause the one or more 

12 processors to carry out the steps of: 
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13 collecting and storing symptom-related data about one or more symptoms, 

14 wherein collecting and storing the symptom-related data includes 

1 5 monitoring the network for one or more network events identified in 

16 the symptom-event rule; and 

17 detecting a problem within the network, wherein detecting the problem 

18 includes applying the problem-diagnosis rule to the symptom-related 

19 data. 

1 16. An apparatus as recited in Claim 1 5, wherein the rule editor is capable of providing to 

2 a user means for reviewing the set of rules to identify and resolve a conflict between two or 

3 more rules in the set 

1 17. An apparatus as recited in Claim 15, wherein: 

2 the problem-diagnosis rule defming the correlation between one or more symptoms 

3 includes one or more pre-defined indicators associated with the one or more 

4 symptoms; and 

5 the diagnosis engine instructions for carrying out the step of detecting a problem 

6 within the network fiuther include instructions for carrying out the steps of: 

7 comparing the symptom-related data to the one or more pre-defined indicators 

8 associated with the one or more symptoms to determine whether a 

9 particular symptom exists in the symptom-related data; 

10 repeating the step of comparing the symptom-related data for all symptoms 

1 1 identified in the problem-diagnosis rule; and 

12 only if all correlated symptoms identified in the problem-diagnosis rule exist, 

13 determining that the problem defined in the problem-diagnosis rule is 

14 detected. 

1 18. An apparatus as recited in Claim 1 5, wherein the symptom-event rule fiirther 

2 includes: 

3 information identifying a particular network device; and 
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4 a data-collection command, wherein the data-collection command, when executed on 

5 the particular network device, returns symptom-related data associated with 

6 the particular network device. 

1 19. An apparatus as recited in Claim 1 5, wherein: 

2 the set of rules further includes a problem-correction rule defining one or more 

3 corrective actions capable of correcting the problem within the network; and 

4 the diagnosis engine further includes instructions which, when executed by the one or 

5 more processors, cause the one or more processors to carry out the step of 

6 recommending to a user one or more corrective actions defined in the 

7 problem-correction rule. 

1 20. An apparatus as recited in Claim 19, wherein the diagnosis engine further includes 

2 instructions which, when executed by the one or more processors, cause the one or more 

3 processors to carry out the step of applying to a network device, without user intervention, 

4 one or more corrective actions defined in the problem-correction rule. 

1 21. An apparatus as recited in Claim 19, wherein: 

2 the network is a first network in a plurality of networks; and 

3 the apparatus further includes a rule broker, wherein the rule broker receives a request 

4 fi-om a user to apply a particular rule in managing a second network, separate 

5 fi-om the first network, and distributes to a device on the second network the 

6 one or more RBML documents storing the particular rule. 

1 22. A computer-readable medium carrying one or more sequences of instructions for 

2 rule-based network management, which instructions, when executed by one or more 

3 processors, cause the one or more processors to carry out the steps of: 

4 defining and storing a set of rules in one or more Rule-Based Markup Language 

5 ("RBML") documents, wherein the one or more RBML documents include 

6 one or more tags defining one or more rule elements, and wherein the set of 

7 rules includes; 
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8 a symptom-event rule that identifies as a symptom a particular event occurring 

9 within the network; and 

10 a problem-diagnosis rule that defines a problem within the network as a 

1 1 correlation between one or more symptoms; 

12 collecting and storing symptom-related data about one or more symptoms, wherein 

13 collecting and storing the symptom-related data includes monitoring the 

14 network for one or more network events identified in the symptom-event rule; 

15 and 

16 detecting a problem within the network, wherein detecting the problem includes 

17 applying the problem-diagnosis rule to the symptom-related data. 

1 23. A computer-readable medium as recited in Claim 22, fiirther comprising instructions 

2 which, when executed by the one or more processors, cause the one or more processors to 

3 carry out the step of reviewing the set of rules to identify and resolve a conflict between two 

4 or more rules in the set. 

1 24. A computer-readable medium as recited in Claim 22, fiuther comprising instructions 

2 which, when executed by the one or more processors, cause the one or more processors to 

3 carry out the step of storing the one or more RBML documents in a rule repository, wherein 

4 the rule repository includes one or more directories containing RBML documents. 

1 25. A computer-readable medium as recited in Claim 22, wherein a RBML document 

2 storing the problem-diagnosis rule includes: 

3 a problem-definition tag describing a problem; and 

4 a correlation tag identifying the correlation between one or more symptoms, wherein 

5 the one or more symptoms are defined in one or more symptom tags that 

6 include one or more pre-defined indicators associated with the one or more 

7 symptoms. 
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1 26. A computer-readable medium as recited in Claim 25, further comprising instructions 

2 which, when executed by the one or more processors, cause the one or more processors to 

3 carry out the steps of: 

4 comparing the symptom-related data to the one or more pre-defined indicators 

5 associated with a particular symptom to determine whether the particular 

6 symptom exists in the symptom-related data; 

7 repeating the step of comparing the symptom-related data for all symptoms identified 

8 in the correlation tag of the RBML document storing the problem-diagnosis 

9 rule; and 

10 only if all symptoms identified in the correlation tag exist, determining that the 

1 1 problem identified in the problem-definition tag is detected. 

1 27. A computer-readable medium as recited in Claim 22, wherein a RBML document 

2 storing the symptom-event rule includes: 

3 an event tag identifying the particular event occurring on the network; and 

4 a symptom tag identifying a symptom as a generalized abstraction of the particular 

5 event. 

1 28. A computer-readable medium as recited in Claim 27, wherein the RBML document 

2 storing the symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection conmiand, wherein the data-collection 

5 command, when executed on the particular network device, retxmis symptom- 

6 related data associated with the particular network device. 

1 29. A computer-readable medium as recited in Claim 22, wherein: 

2 the set of rules further includes a problem-correction rule defining one or more 

3 corrective actions capable of correcting the problem within the network; and 
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4 the computer-readable medium further comprises instructions which, when executed 

5 by the one or more processors, cause the one or more processors to carry out 

6 the step of recommending to a user one or more corrective actions defined in a 

7 RBML document storing the problem-correction rule. 

1 30. A computer-readable medium as recited in Claim 29, further comprising instructions 

2 which, when executed by the one or more processors, cause the one or more processors to 

3 carry out the step of applying to a network device, without user intervention, one or more 

4 corrective actions defined in the problem-correction rule. 

1 31. A computer-readable medium as recited in Claim 22, wherein: 

2 the network is a first network in a pluraUty of networks; and 

3 the computer-readable medium further comprises instructions which, when executed 

4 by the one or more processors, cause the one or more processors to carry out 

5 the steps of: 

6 receiving a request fi*om a user to employ a particular rule in managing a 

7 second network, separate firom the first network; and 

8 distributing to a device on the second network the one or more RBML 

9 documents storing the particular rule. 

1 32. A computer-readable medium carrying one or more sequences of instructions for 

2 defining a Rule-Based Markup Language ("RBML") to describe a set of rules for managing a 

3 network, which instructions, when executed by one or more processors, cause the one or 

4 more processors to carry out the steps of: 

5 creating one or more RBML documents for storing the set of rules, wherein the one or 

6 more RBML documents include one or more tags defining one or more rule 

7 elements, and wherein: 

8 a RBML document storing a symptom-event rule from the set of rules 

9 includes: 

10 an event tag identifying a particular event occurring on the network; 

11 and 
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12 a symptom tag identifying a symptom as a generalized abstraction of 

13 the particular event; and 

14 a RBML document storing a problem-diagnosis rule from the set of rules 

15 includes: 

16 a problem-definition tag describing a problem; and 

17 a correlation tag identifying a correlation between one or more 

18 symptoms, wherein the one or more symptoms are defined in 

19 one or more symptom tags that include one or more pre- 

20 defined indicators associated with the one or more symptoms; 

21 and 

22 generating, from information stored in one or more tags of the one or more RBML 

23 documents, one or more sequences of instructions, which instructions, when 

24 executed by one or more processors, cause the one or more processors to carry 

25 out the steps of: 

26 collecting and storing symptom-related data about one or more symptoms, 

27 wherein collecting and storing the symptom-related data includes 

28 monitoring the network for one or more network events identified in 

29 the symptom-event rule; and 

30 detecting a problem within the network, wherein detecting the problem 

3 1 includes applying the problem-diagnosis rale to the symptom-related 

32 data. 

1 33. A computer-readable medium as recited in Claim 32, wherein the instractions for 

2 detecting a problem within the network further comprise instractions for carrying out the 

3 steps of: 

4 comparing the symptom-related data to the one or more pre-defined indicators 

5 associated with the one or more symptoms to determine whether a particular 

6 symptom exists in the symptom-related data; 

7 repeating the step of comparing the symptom-related data for all symptoms identified 

8 in the correlation tag of the RBML document storing the problem-diagnosis 

9 rale; and 
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10 only if all symptoms identified in the correlation tag exist, deteraiining that the 

1 1 problem identified in the problem-definition tag is detected. 

1 34. A computer-readable medium as recited in Claim 32, wherein the RBML document 

2 storing the symptom-event rule further includes: 

3 a profile tag identifying a particular network device; and 

4 a command tag identifying a data-collection command, wherein the data-collection 

5 command, when executed on the particular network device, returns symptom- 

6 related data associated with the particular network device. 

1 35. A computer-readable medium as recited in Claim 32, wherein: 

2 the instructions for creating one or more RBML documents further comprise 

3 instructions for carrying out the step of creating a RBML document for storing 

4 a problem-correction rule defining one or more corrective actions capable of 

5 correcting the problem within the network; and 

6 the instructions for generating one or more sequences of instructions, by using 

7 information stored in one or more tags of one or more RBML documents, 

8 further comprise instructions for carrying out the step of reconmiending to a 

9 user the one or more corrective actions defined in the RBML document 
1 0 storing the problem-correction rule. 
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